yvgude/lean-ctx v2.18.1

on GitHub

Code Quality & Security Hardening

Fixed

• Shell injection in CLI — lean-ctx grep and lean-ctx find no longer shell-interpolate user input; replaced with pure Rust implementation using ignore::WalkBuilder + regex
• Panic in report_gotcha — unwrap() after add_or_merge could panic when gotcha store exceeds capacity (100 entries) and the new entry gets evicted; now returns Option<&Gotcha> safely
• Broken FilterEngine cache — Removed dead get_or_load() method that stored empty rules in a Mutex and was never called; CACHED_ENGINE static removed
• unwrap() after is_some() pattern — Replaced fragile double-lookup + unwrap() with idiomatic if let Some() / match in ctx_read, ctx_smart_read, and ctx_delta
• graph CLI argument parsing — lean-ctx graph build /path now correctly separates action from path argument

Added

• lean-ctx graph CLI command — Build the project dependency graph from the command line (lean-ctx graph [build] [path]); previously only available via MCP ctx_graph tool
• Consolidated detect_project_root — Single implementation in core::protocol replacing 3 duplicate copies across server.rs, ctx_read.rs, and dashboard/mod.rs

Changed

• Tokio features trimmed — features = ["full"] replaced with 8 specific features (rt, rt-multi-thread, macros, io-std, io-util, net, sync, time), reducing compile time and binary size
• Security workflow updated — security-check.yml now correctly documents ureq as the allowed HTTP client (for opt-in cloud sync, updates, error reports) instead of claiming "no network"

Upgrade

cargo install lean-ctx          # or
npm update -g lean-ctx-bin      # or
brew upgrade lean-ctx

Full Changelog: v2.18.1...v2.18.1